SA-CONTRIB-2026-015: CAPTCHA Access Bypass — Token Reuse That Breaks Your Spam Gate

SA-CONTRIB-2026-015 is a token lifecycle failure: solved CAPTCHA tokens were not invalidated reliably, which means follow-up submissions could bypass CAPTCHA checks entirely. 🚨 Danger: Patch Now — Token Reuse Bypass CVE-2026-3214 allows CAPTCHA bypass through token reuse. If you run drupal/captcha below 1.17.0 (1.x) or below 2.0.10 (2.x), your forms are not protected the way you think they are. Update today. Severity Snapshot SA ID CVE Severity Affected Versions Patched Version Action SA-CONTRIB-2026-015 CVE-2026-3214 Moderately Critical < 1.17.0 or >= 2.0.0, < 2.0.10 8.x-1.17 / 2.0.10 Update immediately What Happened The Drupal Security Team published SA-CONTRIB-2026-015 on February 25, 2026 for the CAPTCHA module ( drupal/captcha ). The advisory is classified as an access bypass vulnerability. The core issue: under certain scenarios, used security tokens could remain reusable instead of being invalidated after a successful CAPTCHA solve. flowchart TD A[User solves CAPTCHA] --> B{Toke